DKIM Rotation with CNAME Key Delegation using Entri Connect

Last updated: October 9, 2025

Overview

DKIM (DomainKeys Identified Mail) rotation is a security practice that involves periodically updating your DKIM keys to prevent attackers from using stolen keys for fraudulent emails. This guide explains how to implement DKIM rotation using CNAME key delegation with Entri, allowing you to automate the process while maintaining security.

What is DKIM Key Rotation?

DKIM key rotation is the process of creating new DKIM keys and updating your DNS records with those new keys. Think of it like changing your passwords periodically - it's a security measure that helps prevent attackers from impersonating your domain and sending spam or phishing emails.

Why Rotate DKIM Keys?

  • Security: Prevents bad actors from using compromised keys to send fraudulent emails

  • Best Practice: Industry standard recommends rotating keys every few months

  • Compliance: Many security frameworks require regular key rotation

  • Risk Mitigation: Limits exposure if a private key is ever compromised

Understanding CNAME Key Delegation

CNAME key delegation allows you to outsource DKIM key management to a trusted third party (like an email SaaS provider) while maintaining control over your domain. Instead of managing the DKIM keys directly, you create CNAME records that point to externally managed DKIM records.

How It Works

  1. End-User Domain: example.com (the domain from which emails will be signed)

  2. Service Provider: saas-provider.com (handles DKIM signing and rotation)

  3. CNAME Record: Points your DKIM selector to the provider's managed record

Example CNAME Record:

s1._domainkey.example.com CNAME s1.example.com.saas-provider.com

The provider maintains the actual DKIM record:

s1.example.com.saas-provider.com TXT "v=DKIM1; p=MIG89hdg599..."

Setting Up DKIM Rotation with Entri

Use Entri's API to create the CNAME records for DKIM delegation:

// Example Entri configuration
const config = {
  applicationId: "your-app-id",
  token: "your-jwt-token",
  dnsRecords: [
    {
      host: "s1._domainkey",
      type: "CNAME", 
      value: "s1.{DOMAIN}.saas-provider.com",
      ttl: 300
    },
    {
      host: "s2._domainkey",
      type: "CNAME",
      value: "s2.{DOMAIN}.saas-provider.com", 
      ttl: 300
    },
    {
      host: "s3._domainkey",
      type: "CNAME",
      value: "s3.{DOMAIN}.saas-provider.com",
      ttl: 300
    }
  ]
};

entri.showEntri(config);

Entri supports dynamic variables that automatically populate based on the user's domain:

  • {DOMAIN} - The full domain (e.g., example.com)

  • {SUBDOMAIN} - Any subdomain part (e.g., blog)

By implementing DKIM rotation through CNAME key delegation with Entri, you can automate this critical security process while maintaining full control over your domain's email authentication. This approach reduces manual overhead while ensuring your email infrastructure remains secure and compliant with industry best practices for your customers.

Need additional help? Contact our support team through the Entri dashboard or visit our help center for more resources.